Buggy code:
public class HttpServer extends AbstractLifecycleComponent < HttpServer > { private final Environment environment ; private final HttpServerTransport transport ; private final RestController restController ; private final NodeService nodeService ; private final boolean disableSites ; private final HttpServer . PluginSiteFilter pluginSiteFilter = new HttpServer . PluginSiteFilter ( ) ; @ Inject public HttpServer ( Settings settings , Environment environment , HttpServerTransport transport , RestController restController , NodeService nodeService ) { } static class Dispatcher implements HttpServerAdapter { private final HttpServer server ; Dispatcher ( HttpServer server ) { } @ Override public void dispatchRequest ( HttpRequest request , HttpChannel channel ) { } } @ Override protected void doStart ( ) throws ElasticsearchException { } @ Override protected void doStop ( ) throws ElasticsearchException { } @ Override protected void doClose ( ) throws ElasticsearchException { } public HttpInfo info ( ) { } public HttpStats stats ( ) { } public void internalDispatchRequest ( final HttpRequest request , final HttpChannel channel ) { } class PluginSiteFilter extends RestFilter { @ Override public void process ( RestRequest request , RestChannel channel , RestFilterChain filterChain ) throws IOException { } } void handlePluginSite ( HttpRequest request , HttpChannel channel ) throws IOException { if ( disableSites ) { channel . sendResponse ( new BytesRestResponse ( FORBIDDEN ) ) ; return ; } if ( ( request . method ( ) ) == ( Method . OPTIONS ) ) { channel . sendResponse ( new BytesRestResponse ( OK ) ) ; return ; } if ( ( request . method ( ) ) != ( Method . GET ) ) { channel . sendResponse ( new BytesRestResponse ( FORBIDDEN ) ) ; return ; } String path = request . rawPath ( ) . substring ( "//_plugin//" . length ( ) ) ; int i1 = path . indexOf ( '//' ) ; String pluginName ; String sitePath ; if ( i1 == ( - 1 ) ) { pluginName = path ; sitePath = null ; String redirectUrl = ( request . rawPath ( ) ) + "//" ; BytesRestResponse restResponse = new BytesRestResponse ( RestStatus . MOVED_PERMANENTLY , "text//html" , ( ( "<head><meta<seq2seq4repair_space>http-equiv=\"refresh\"<seq2seq4repair_space>content=\"0;<seq2seq4repair_space>URL=" + redirectUrl ) + "><//head>" ) ) ; restResponse . addHeader ( "Location" , redirectUrl ) ; channel . sendResponse ( restResponse ) ; return ; } else { pluginName = path . substring ( 0 , i1 ) ; sitePath = path . substring ( ( i1 + 1 ) ) ; } if ( ( sitePath . length ( ) ) == 0 ) { sitePath = "//index.html" ; } final Path siteFile = environment . pluginsFile ( ) . resolve ( pluginName ) . resolve ( "_site" ) ; final String separator = siteFile . getFileSystem ( ) . getSeparator ( ) ; sitePath = sitePath . replace ( "//" , separator ) ; Path file = FileSystemUtils . append ( siteFile , Paths . get ( sitePath ) , 0 ) ; if ( ( ! ( Files . exists ( file ) ) ) || ( Files . isHidden ( file ) ) ) { channel . sendResponse ( new BytesRestResponse ( NOT_FOUND ) ) ; return ; } BasicFileAttributes attributes = Files . readAttributes ( file , BasicFileAttributes . class ) ; if ( ! ( attributes . isRegularFile ( ) ) ) { if ( ! ( attributes . isDirectory ( ) ) ) { channel . sendResponse ( new BytesRestResponse ( FORBIDDEN ) ) ; return ; } file = file . resolve ( "index.html" ) ; if ( ( ( ! ( Files . exists ( file ) ) ) || ( Files . isHidden ( file ) ) ) || ( ! ( Files . isRegularFile ( file ) ) ) ) { channel . sendResponse ( new BytesRestResponse ( FORBIDDEN ) ) ; return ; } } <START_BUG> if ( ! ( file . toAbsolutePath ( ) . startsWith ( siteFile ) ) ) { <END_BUG> channel . sendResponse ( new BytesRestResponse ( FORBIDDEN ) ) ; return ; } try { byte [ ] data = Files . readAllBytes ( file ) ; channel . sendResponse ( new BytesRestResponse ( OK , guessMimeType ( sitePath ) , data ) ) ; } catch ( IOException e ) { channel . sendResponse ( new BytesRestResponse ( INTERNAL_SERVER_ERROR ) ) ; } } private String guessMimeType ( String path ) { } public static final Map < String , String > DEFAULT_MIME_TYPES ; }

Fix:
if ( ! ( file . toAbsolutePath ( ) . startsWith ( siteFile . toAbsolutePath ( ) ) ) ) {